IopValidateJunctionTarget

NTSTATUS __stdcall IopValidateJunctionTarget(
        VOID *InputBuffer,
        UINT64 InputBufferLength,
        UINT64 OutputBufferLength,
        VOID **VerifiedInputBuffer,
        UINT64 *VerifiedInputLength){
  UINT64 v5; 
  int v7; 
  void *v8; 
  wchar_t *PoolWithTag; 
  unsigned int v10; 
  _REPARSE_DATA_BUFFER *PoolWithQuota_1; 
  const VOID *v12; 
  size_t v13; 
  _REPARSE_DATA_BUFFER *v14; 
  int appended; 
  _DEVICE_OBJECT *DeviceObject; 
  char v17; 
  unsigned int v18; 
  int v19; 
  unsigned int v20; 
  unsigned int v21; 
  unsigned int v22; 
  _OWORD *v23; 
  _OWORD *v24; 
  unsigned int Length; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  char v29; 
  _UNICODE_STRING v30; 
  UINT64 ReturnedLength; 
  _FILE_OBJECT *pFileObject; 
  _UNICODE_STRING DestinationString; 
  _REPARSE_DATA_BUFFER *v34; 
  _UNICODE_STRING String2; 
  int v36; 
  _OWORD *v37; 
  VOID *FileHandle; 
  _UNICODE_STRING Destination; 
  _UNICODE_STRING String1; 
  _UNICODE_STRING v41; 
  _UNICODE_STRING Source; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  int v45; 
  int v47; 
  unsigned int v48; 
  unsigned int *v49; 

  v48 = (unsigned int)VerifiedInputBuffer;
  v47 = OutputBufferLength;
  v45 = (int)InputBuffer;
  v5 = (unsigned int)OutputBufferLength;
  v7 = (int)InputBuffer;
  String2 = 0i64;
  *(_QWORD *)&Source.Length = 1572886i64;
  Source.Buffer = L"\\??\\Global\\";
  *(_QWORD *)&v41.Length = 2359330i64;
  v41.Buffer = L"\\??\\Global\\Volume";
  IoStatusBlock = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  Destination = 0i64;
  DestinationString = 0i64;
  *(_QWORD *)&String1.Length = 1441812i64;
  String1.Buffer = (wchar_t *)L"\\??\\Volume";
  v34 = 0i64;
  v8 = 0i64;
  v37 = 0i64;
  FileHandle = 0i64;
  pFileObject = 0i64;
  PoolWithTag = 0i64;
  RtlInitUnicodeString(&DestinationString, 0i64);
  if( v7 == 590860 )
  {
    v10 = v5 - 32;
    v36 = v5 - 32;
    PoolWithQuota_1 = (_REPARSE_DATA_BUFFER *)IopVerifierExAllocatePoolWithQuota_1(
                                                NonPagedPoolNx,
                                                (unsigned int)(v5 - 32));
    v12 = (const VOID *)(InputBufferLength + 32);
    v13 = v5 - 32;
  }
  else
  {
    v10 = v5;
    v36 = v5;
    PoolWithQuota_1 = (_REPARSE_DATA_BUFFER *)IopVerifierExAllocatePoolWithQuota_1(NonPagedPoolNx, v5);
    v13 = v5;
    v12 = (const VOID *)InputBufferLength;
  }
  v14 = PoolWithQuota_1;
  v34 = PoolWithQuota_1;
  memmove(PoolWithQuota_1, v12, v13);
  appended = FsRtlValidateReparsePointBuffer(v10, v14);
  if( appended >= 0 )
  {
    String2.Buffer = v14->MountPointReparseBuffer.PathBuffer;
    String2.Length = v14->SymbolicLinkReparseBuffer.SubstituteNameLength & 0xFFFE;
    String2.MaximumLength = String2.Length;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 1536;
    ObjectAttributes.ObjectName = &String2;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    LODWORD(OpenOptions) = 1;
    LODWORD(ShareAccess) = 7;
    appended = ZwOpenFile(&FileHandle, 0x120116ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
    if( appended >= 0 )
    {
      appended = IopReferenceFileObject(FileHandle, 0i64, 0, &pFileObject, 0i64);
      if( appended >= 0 )
      {
        DeviceObject = pFileObject->DeviceObject;
        if( (DeviceObject->Characteristics & 0x10) != 0 )
        {
LABEL_8:
          appended = -1073741811;
          goto LABEL_46;
        }
        v17 = 0;
        v29 = 0;
        if( (unsigned __int8)RtlPrefixUnicodeString(&String1, &String2, 1u)
          || (unsigned __int8)RtlPrefixUnicodeString(&v41, &String2, 1u)
          || (appended = IoVolumeDeviceToDosName(DeviceObject, &DestinationString), appended < 0) )
        {
          v17 = 1;
          v29 = 1;
        }
        if( v17 )
          appended = IoVolumeDeviceToGuidPath(pFileObject->DeviceObject, &DestinationString);
        if( appended >= 0 )
        {
          v18 = String2.Length + 8;
          do
          {
            PoolWithTag = (wchar_t *)ExAllocatePoolWithTag(0x200ui64, v18, 1700032329i64);
            *(_QWORD *)&v30.Length = PoolWithTag;
            if( !PoolWithTag )
            {
              appended = -1073741670;
              goto LABEL_46;
            }
            appended = IopQueryXxxInformation(pFileObject, 9ui64, v18, 0, PoolWithTag, &ReturnedLength, 1u);
            if( appended == -2147483643 )
            {
              v18 = *(_DWORD *)PoolWithTag + 8;
              ExFreePoolWithTag(PoolWithTag, 0);
              PoolWithTag = 0i64;
              *(_QWORD *)&v30.Length = 0i64;
            }
          }
          while( appended == -2147483643 );
          if( appended < 0 )
            goto LABEL_46;
          if( !*(_DWORD *)PoolWithTag || PoolWithTag[2] != 92 )
            goto LABEL_8;
          v19 = DestinationString.Length + *(_DWORD *)PoolWithTag + 14;
          if( !v29 )
            v19 = DestinationString.Length + *(_DWORD *)PoolWithTag + 22;
          v20 = v19 - 2;
          if( DestinationString.Buffer[((unsigned __int64)DestinationString.Length >> 1) - 1] != 92 )
            v20 = v19;
          if( v20 >= 0xFFFD )
            goto LABEL_8;
          v21 = v47 + v20 - String2.Length;
          v22 = v48;
          if( v21 > v48 )
            v22 = v47 + v20 - String2.Length;
          v23 = IopVerifierExAllocatePoolWithQuota_1(NonPagedPoolNx, v22);
          v8 = v23;
          v37 = v23;
          if( v45 == 590860 )
          {
            *v23 = *(_OWORD *)InputBufferLength;
            v23[1] = *(_OWORD *)(InputBufferLength + 16);
            v24 = v23 + 2;
            LODWORD(ReturnedLength) = v21 - 32;
          }
          else
          {
            v24 = v23;
            LODWORD(ReturnedLength) = v21;
          }
          Destination.Buffer = (wchar_t *)(v24 + 1);
          Destination.Length = 0;
          Destination.MaximumLength = v20;
          appended = RtlAppendUnicodeStringToString(&Destination, &Source);
          if( appended >= 0 )
          {
            v30 = DestinationString;
            if( v29 )
            {
              v30.Length = DestinationString.Length - 8;
              v30.Buffer += 4;
            }
            if( v30.Buffer[((unsigned __int64)v30.Length >> 1) - 1] == 92 )
              v30.Length -= 2;
            if( !v30.Length || v30.Length > DestinationString.Length )
              goto LABEL_8;
            appended = RtlAppendUnicodeStringToString(&Destination, &v30);
            if( appended >= 0 )
            {
              v30.Buffer = PoolWithTag + 2;
              v30.Length = *PoolWithTag;
              v30.MaximumLength = v30.Length;
              appended = RtlAppendUnicodeStringToString(&Destination, &v30);
              if( appended >= 0 )
              {
                *(_DWORD *)v24 = -1610612733;
                *(_DWORD *)((char *)v24 + 6) = 0;
                *((_WORD *)v24 + 2) = ReturnedLength - 8;
                Length = Destination.Length;
                *((_WORD *)v24 + 5) = Destination.Length;
                *((_WORD *)v24 + ((unsigned __int64)Length >> 1) + 8) = 0;
                LOWORD(Length) = Length + 2;
                *((_WORD *)v24 + 6) = Length;
                memmove(
                  (char *)v24 + (unsigned __int16)Length + 16,
                  &v14->GenericReparseBuffer + v14->SymbolicLinkReparseBuffer.PrintNameOffset + 8,
                  v14->SymbolicLinkReparseBuffer.PrintNameLength + 2);
                *((_WORD *)v24 + 7) = v14->SymbolicLinkReparseBuffer.PrintNameLength;
                *VerifiedInputLength = (UINT64)v8;
                *v49 = v21;
                v8 = 0i64;
              }
            }
          }
        }
        else
        {
          DestinationString.Buffer = 0i64;
        }
      }
    }
  }
LABEL_46:
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  if( v14 )
    ExFreePoolWithTag(v14, 0);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  if( DestinationString.Buffer )
    ExFreePoolWithTag(DestinationString.Buffer, 0);
  if( pFileObject )
    HalPutDmaAdapter((PADAPTER_OBJECT)pFileObject);
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  return appended;
}

Referenced by: